Security audit
Security checks across malware telemetry and agentic risk
This Mallary skill is transparent about its purpose, but it gives an agent broad social-account authority and allows real publishing actions without a final confirmation step.
Install only if you are comfortable giving Mallary broad account access and having your agent publish, schedule, upload media, or reply after it interprets your request as clear. For brand, client, or public-facing accounts, explicitly ask for a preview and final approval before posting, and keep API keys in a secret manager rather than chat or shell history.
1. use minimum read-only discovery to resolve the current profile and destination 2. ask only for a material detail that is missing or ambiguous 3. execute the requested action once without asking for another confirmation 4. verify the result with a read-only command An OAuth setup or discovery request is not a request to post. For deletion, disconnection, or another destructive account action, follow the stronger safeguards in [SKILL.md](./SKILL.md).
- begin with the lowest-risk read-only command that can answer the request - request the minimum data needed and redact sensitive operational output before sharing it - never use a data-transmitting or state-changing action as a setup, authentication, or smoke test - if the user clearly requests publishing, scheduling, an upload for that post, or a reply, follow [SKILL.md](./SKILL.md), resolve any missing material detail, and execute without asking for another confirmation - run a requested action once and verify it with a read-only command Installation, authentication, or discovery alone is not a request to publish or change Mallary.
57/57 vendors flagged this skill as clean.
No suspicious patterns detected.
